cargo-supply-chain's Introduction

cargo-supply-chain

Gather author, contributor and publisher data on crates in your dependency graph.

Use cases include:

Find people and groups worth supporting.
Identify risks in your dependency graph.
An analysis of all the contributors you implicitly trust by building their software. This might have both a sobering and humbling effect.

Sample output when run on itself: publishers, crates, json.

Usage

To install this tool, please run the following command:

cargo install cargo-supply-chain

Once installed, simply navigate to your project and run cargo supply-chain to start. Here's a list of possible subcommands and arguments which you may use:

Commands:
  publishers   List all crates.io publishers in the depedency graph
  crates       List all crates in dependency graph and crates.io publishers for each
  json         Like 'crates', but in JSON and with more fields for each publisher
  update       Download the latest daily dump from crates.io to speed up other commands

See 'cargo supply-chain help <command>' for more information on a specific command.

Arguments:
  --cache-max-age  The cache will be considered valid while younger than specified.
                   The format is a human readable duration such as `1w` or `1d 6h`.
                   If not specified, the cache is considered valid for 48 hours.
  -d, --diffable   Make output more friendly towards tools such as `diff`

Any arguments after the `--` will be passed to `cargo metadata`, for example:
  cargo supply-chain crates -- --filter-platform=x86_64-unknown-linux-gnu
See `cargo metadata --help` for a list of flags it supports.